security-detections-mcp

What problem does it solve?

Teams struggle to quickly find relevant security detections across multiple rule formats while understanding how well their coverage maps to MITRE ATT&CK and where detection gaps exist.

Core Features & Use Cases

• Unified cross-platform detection querying: Search and retrieve rules across Sigma, Splunk (ESCU), Elastic, KQL, Sublime, and CrowdStrike CQL formats from one MCP interface.
• MITRE ATT&CK mapping and coverage analysis: Identify which tactics, techniques, actors, and procedures are covered (and which are missing) for use cases like ransomware readiness and actor emulation.
• ATT&CK Navigator layer output: Generate layer JSON to visualize coverage for stakeholders and to guide engineering sprints.
• Autonomous detection engineering workflows: Support a pipeline approach that ingests CTI, runs gap analysis, and helps draft detection improvements.

Quick Start

Ask for detection coverage by saying: "Show me Splunk detections for credential dumping and summarize the MITRE ATT&CK coverage gaps for that technique."